Cryptographic Issues

Affecting bcrypt package, versions <5.0.0

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

bcrypt is an A library to help you hash passwords.

Affected versions of this package are vulnerable to Cryptographic Issues. When hashing a password containing an ASCII NUL character, that character acts as the string terminator. Any following characters are ignored.

Remediation

Upgrade bcrypt to version 5.0.0 or higher.

References

CVSS Score

5.9
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    High
  • Availability
    None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:R
Credit
Felix
CWE
CWE-310
Snyk ID
SNYK-JS-BCRYPT-575033
Disclosed
13 Jan, 2020
Published
01 Jul, 2020